Privacy policy.

1. Introduction

Something Cool Enterprise Limited ("we," "our," or "us") is the data controller for personal data collected through this website and our HVAC, solar, and Mutabank product and service offerings. We operate from Old Harbour, St Catherine, Jamaica. This policy describes what we collect, why, how long we keep it, who we share it with, and the rights you have under the Jamaica Data Protection Act 2020 (DPA).

2. Information we collect

3. Lawful bases for processing

Section 21 of the DPA requires us to identify a lawful basis for each processing activity. Ours are:

• Performance of a contract — fulfilling orders, issuing quotes, scheduling installs, processing payments and refunds, providing warranty service
• Legal obligation — keeping tax, accounting, and consumer-protection records required by Jamaican law
• Legitimate interest — preventing fraud, securing our systems, improving the site, defending legal claims
• Consent — marketing emails, optional analytics cookies, and any other processing where we ask you to opt in

4. How we use your information

• Processing orders, quotes, service bookings, and refunds
• Sending order, quote, dispatch, and warranty communications
• Scheduling installs and follow-up maintenance
• Operating the website and improving the customer experience
• Detecting fraud and securing accounts
• Complying with Jamaican tax, consumer-protection, and data-protection law
• Marketing emails — only if you opt in; you can opt out any time

5. Cookies and tracking

We use cookies in three categories:

• Essential — required for login, cart, and checkout. These cannot be turned off without breaking the site.
• Analytics — help us understand site usage. These run only with your consent and can be withdrawn from your browser at any time.
• Preference — remember settings such as cart contents and language.

We keep a record of your cookie consent choice. You can change your choice or withdraw consent at any time from your browser; analytics cookies will stop being set on your next visit.

6. Who we share your information with

We do not sell personal information. We share data only with the following processors, each acting on our written instructions and bound by appropriate safeguards:

• NCB First Atlantic Commerce / PowerTranz — card authorisation and settlement. Card data is captured directly by the gateway and never reaches our servers.
• Google LLC — Google Sign-In (authentication) and Google Analytics 4 (site usage)
• Resend — transactional email delivery (order confirmations, quote emails, password resets)
• AMS (our order-management partner) — dispatch routing and inventory sync
• Couriers and dispatch partners — name, address, and phone strictly to complete delivery
• Equipment manufacturers — only what is required to register warranty
• Professional advisers and authorities — accountants, auditors, regulators, courts, the Office of the Information Commissioner, or law enforcement where required by Jamaican law

7. International transfers

Some of our processors are based outside Jamaica. Where that is the case, we rely on the safeguards listed below to meet DPA standards (Standard Contractual Clauses, equivalent contractual commitments, or transfers covered by the processor's certification programmes):

• Google (United States) — Standard Contractual Clauses
• Resend (United States) — Standard Contractual Clauses
• FAC / PowerTranz — PCI-DSS certified payment processing under card-scheme rules
• AMS — bilateral data-processing agreement

8. Data security

We use TLS encryption in transit, bcrypt password hashing, role-based access controls, audit logging of administrative actions, and regular review of who has access. We do not store full card numbers, expiry dates, or CVV values — see our security page for detail.

9. Data retention

• Order and transaction records — 7 years (tax and consumer-claim window)
• Service and warranty records — for the duration of the applicable warranty plus 3 years
• Account profile — until you ask us to delete it, or 3 years after your last order
• Marketing consent records — until you withdraw consent, plus 1 year for audit
• Quote audit log — 3 years from quote issue
• Server access logs — 90 days

10. Your rights

Under the DPA you have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate or incomplete
• Request deletion (the "right to be forgotten") where applicable
• Receive a portable copy of the data you provided to us
• Object to processing based on legitimate interest
• Withdraw consent at any time where consent is our lawful basis
• Lodge a complaint with the Office of the Information Commissioner of Jamaica

To exercise any of these rights, email admin@somethingcoolenterprise.com. We respond within 30 days, in line with section 40 of the DPA. We may ask you to verify your identity before we act.

11. Personal data breaches

If a breach of personal data occurs and is likely to cause harm, we will notify the Office of the Information Commissioner and affected data subjects without undue delay, in line with section 30 of the DPA. Notice will describe what happened, what data is involved, what we are doing about it, and what you can do to protect yourself.

12. Children's privacy

Our services are intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Automated decision-making

We do not make decisions about you using automated processing alone that produce legal or similarly significant effects. Pricing for delivery and installation is set manually by a human admin — see our terms of service for how the quote process works.

14. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be flagged on the site with a revised "Last updated" date. Continued use of the site after the effective date constitutes acceptance of the updated policy.